--- loncom/publisher/loncfile.pm	2009/08/28 01:08:48	1.102
+++ loncom/publisher/loncfile.pm	2011/03/01 01:36:55	1.106
@@ -9,7 +9,7 @@
 #  and displays a page showing the results of the action.
 #
 #
-# $Id: loncfile.pm,v 1.102 2009/08/28 01:08:48 raeburn Exp $
+# $Id: loncfile.pm,v 1.106 2011/03/01 01:36:55 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -348,6 +348,7 @@ sub cleanDest {
     my ($request,$dest,$subdir,$fn,$uname)=@_;
     #remove bad characters
     my $foundbad=0;
+    my $error='';
     if ($subdir && $dest =~/\./) {
 	$foundbad=1;
 	$dest=~s/\.//g;
@@ -359,18 +360,18 @@ sub cleanDest {
     }
     if ($dest=~m|/|) {
 	my ($newpath)=($dest=~m|(.*)/|);
-	$newpath=&relativeDest($fn,$newpath,$uname);
+	($newpath,$error)=&relativeDest($fn,$newpath,$uname);
 	if (! -d "$newpath") {
 	    $request->print('<p><span class="LC_warning">'
                            .&mt("You have requested to create file in directory [_1] which doesn't exist. The requested directory path has been removed from the requested file name."
-                               ,'<span class="LC_filename">'.&display($newpath).'</span>')
+                               ,&display($newpath))
                            .'</span></p>');
 	    $dest=~s|.*/||;
 	}
     }
     if ($dest =~ /\.(\d+)\.(\w+)$/){
 	$request->print('<p><span class="LC_warning">'
-			.&mt('Bad filename [_1]','<span class="LC_filename">'.&display($dest).'</span>')
+			.&mt('Bad filename [_1]',&display($dest))
                         .'<br />'
                         .&mt('[_1](name).(number).(extension)[_2] not allowed.','<tt>','</tt>')
                         .'<br />'
@@ -384,11 +385,12 @@ sub cleanDest {
                         .'</span></p>'
         );
     }
-    return $dest;
+    return ($dest,$error);
 }
 
 sub relativeDest {
     my ($fn,$newfilename,$uname)=@_;
+    my $error = '';
     if ($newfilename=~/^\//) {
 # absolute, simply add path
 	$newfilename='/home/'.$uname.'/public_html/';
@@ -401,7 +403,18 @@ sub relativeDest {
     while ($newfilename=~m:/\.\./:) {
 	$newfilename=~ s:/[^/]+/\.\./:/:g; #remove dir/..
     }
-    return $newfilename;
+    if ($newfilename =~ m{^/home/($match_username)/(?:public\_html|priv)/}) {
+        my $otheruname = $1;
+        unless ($otheruname eq $uname) {
+            my ($authorname,$authordom)=
+                &Apache::loncacc::constructaccess($newfilename,$env{'request.role.domain'});
+            unless (($authorname eq $otheruname) && ($authordom ne '')) {
+                my $otherdir = &display($newfilename);
+                $error = &mt('Access denied to [_1]',$otherdir);
+            }
+        }
+    }
+    return ($newfilename,$error);
 }
 
 =pod
@@ -552,8 +565,9 @@ sub Rename1 {
             $request->print('<input type="hidden" name="newfilename" value="'
                            .$newfilename.'" />'
                            .'<p>'
-                           .&mt($action.' [_1] to [_2]?'
-                               ,&display($fn),&display($newfilename))
+                           .&mt($action.' [_1] to [_2]?',
+                                &display($fn),
+                                &display($newfilename))
                            .'</p>'
         );
 	    &CloseForm1($request, $fn);
@@ -563,8 +577,8 @@ sub Rename1 {
 	}
     } else {
         $request->print('<p class="LC_error">'
-                       .&mt('No such file: [_1]'
-                           ,'<span class="LC_filename">'.&display($fn).'</span>')
+                       .&mt('No such file: [_1]',
+                            &display($fn))
                        .'</p></form>'
         );
 	return;
@@ -625,15 +639,15 @@ sub Delete1 {
 	    }
         }
         $request->print('<p>'
-                       .&mt('Delete [_1]?'
-                           ,'<span class="LC_filename">'.&display($fn).'</span>')
+                       .&mt('Delete [_1]?',
+                            &display($fn))
                        .'</p>'
         );
 	&CloseForm1($request, $fn);
     } else {
         $request->print('<p class="LC_error">'
-                       .&mt('No such file: [_1]'
-                           ,'<span class="LC_filename">'.&display($fn).'</span>')
+                       .&mt('No such file: [_1]',
+                            &display($fn))
                        .'</p></form>'
         );
     }
@@ -689,19 +703,20 @@ sub Copy1 {
 	    $request->print('<br /><a href="'.&url($fn).'">'.&mt('Cancel').'</a>');
 	    return;
 	}
-        $request->print('<input type="hidden" name="newfilename" value="'
-                       .$newfilename.'" />'
-                       .'<p>'
-                       .&mt('Copy [_1] to [_2]?'
-                           ,'<span class="LC_filename">'.&display($fn).'</span>'
-                           ,'<span class="LC_filename">'.&display($newfilename).'</span>')
-                       .'</p>'
+    $request->print(
+        '<input type="hidden" name="newfilename"'
+       .' value="'.$newfilename.'" />'
+       .'<p>'
+       .&mt('Copy [_1] to [_2]?',
+            &display($fn),
+            &display($newfilename))
+       .'</p>'
         );
 	&CloseForm1($request, $fn);
     } else {
         $request->print('<p class="LC_error">'
-                       .&mt('No such file: [_1]'
-                           ,'<span class="LC_filename">'.&display($fn).'</span>')
+                       .&mt('No such file: [_1]',
+                            &display($fn))
                        .'</p></form>'
         );
     }
@@ -754,16 +769,15 @@ sub NewDir1 {
     if ($type eq 'error') {
 	$request->print('</form>');
     } else {
-	if ($mode eq 'testbank') {
-	    $request->print('<input type="hidden" name="callingmode" value="testbank" />');
-	} elsif ($mode eq 'imsimport') {
-	    $request->print('<input type="hidden" name="callingmode" value="imsimport" />');
+	if (($mode eq 'testbank') || ($mode eq 'imsimport')) {
+	    $request->print('<input type="hidden" name="callingmode" value="'.$mode.'" />'."\n".
+                            '<input type="hidden" name="inhibitmenu" value="yes" />');
 	}
         $request->print('<input type="hidden" name="newfilename" value="'
                        .$newfilename.'" />'
                        .'<p>'
-                       .&mt('Make new directory [_1]?'
-                           ,'<span class="LC_filename">'.&display($newfilename).'</span>')
+                       .&mt('Make new directory [_1]?',
+                            &display($newfilename))
                        .'</p>'
         );
 	&CloseForm1($request, $fn);
@@ -776,15 +790,15 @@ sub Decompress1 {
     if( -e $fn) {
    	$request->print('<input type="hidden" name="newfilename" value="'.$fn.'" />');
    	$request->print('<p>'
-                   .&mt('Decompress [_1]?'
-                       ,'<span class="LC_filename">'.&display($fn).'</span>')
+                   .&mt('Decompress [_1]?',
+                        &display($fn))
                    .'</p>'
     );
    	&CloseForm1($request, $fn);
     } else {
         $request->print('<p class="LC_error">'
-                       .&mt('No such file: [_1]'
-                           ,'<span class="LC_filename">'.&display($fn).'</span>')
+                       .&mt('No such file: [_1]',
+                            &display($fn))
                        .'</p></form>'
         );
     }
@@ -935,8 +949,23 @@ sub phaseone {
   
     my $doingdir=0;
     if ($env{'form.action'} eq 'newdir') { $doingdir=1; }
-    my $newfilename=&cleanDest($r,$env{'form.newfilename'},$doingdir,$fn,$uname);
-    $newfilename=&relativeDest($fn,$newfilename,$uname);
+    my ($newfilename,$error) = 
+        &cleanDest($r,$env{'form.newfilename'},$doingdir,$fn,$uname);
+    unless ($error) {
+        ($newfilename,$error)=&relativeDest($fn,$newfilename,$uname);
+    }
+    if ($error) {
+        my $dirlist;
+        if ($fn=~m{^(.*/)[^/]+$}) {
+            $dirlist=$1;
+        } else {
+            $dirlist=$fn; 
+        }
+        $r->print('<div class="LC_error">'.$error.'</div>'.
+                  '<h3><a href="'.&url($dirlist).'">'.&mt('Return to Directory').
+                  '</a></h3>');
+        return;
+    }
     $r->print('<form action="/adm/cfile" method="post">'.
 	      '<input type="hidden" name="qualifiedfilename" value="'.$fn.'" />'.
 	      '<input type="hidden" name="phase" value="two" />'.
@@ -1069,10 +1098,11 @@ sub Rename2 {
 	    unlink $tmp2;
 	}
     } else {
-        $request->print('<p>'
-                       .&mt('No such file: [_1]'
-                           ,'<span class="LC_filename">'.&display($oldfile).'</span>')
-                       .'</p></form>'
+        $request->print(
+            '<p>'
+           .&mt('No such file: [_1]',
+                &display($oldfile))
+           .'</p></form>'
         );
 	return 0;
     }
@@ -1469,7 +1499,7 @@ function writeDone() {
     $r->print('<h3>'.&mt('Location').': '.&display($fn).'</h3>');
   
     if (($uname ne $env{'user.name'}) || ($udom ne $env{'user.domain'})) {
-        $r->print('<p class="LC_warning">'
+        $r->print('<p class="LC_info">'
                  .&mt('Co-Author [_1]',$uname.':'.$udom)
                  .'</p>'
         );